The effects of reduced "free will" on Bell-based randomness expansion 
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With tlie advent of quantum information, the violation of a Bell inequality is used as evidence of 
the absence of an eavesdropper in cryptographic scenarios such as key distribution and randomness 
expansion. One of the key assumptions of Bell's Theorem is the existence of experimental "free will" , 
meaning that measurement settings can be chosen at random and independently by each party. The 
relaxation of this assumption potentially shifts the balance of power towards an eavesdropper. We 
consider a no-signalling model with reduced "free will" and bound the adversary's capabilities in 
the task of randomness expansion. 

PACS numbers: 03.65.Ta, 03.65.Ud 



Introduction. — A source of random data that can be 
trusted to be truly random, and not just repeating a 
pre-determined, apparently random, sequence is a vital 
resource in many applications. A real-world scenario is 
online gambling, where accusations abound of sites rig- 
ging the deck, etc. Quantum mechanics has long been 
known to provide intrinsic randomness, but it has re- 
cently been noticed that Bell tests allow us to go fur- 
ther: they provide quantitative bounds for the amount 
of randomness that is generated [TH3]. Moreover, these 
bounds are device-independent, in the sense that they 
are obtained only from the observed statistics, without 
reference to a description of the physical system or the 
implemented operations. Two different types of bound 
can be achieved, either by assuming the validity of quan- 
tum mechanics or merely with the weaker assumption of 
no-signalling in a fully black-box scenario. 

In a randomness expansion protocol, a pre-established 
stock of randomness (for instance, a string of random 
bits) is used to make measurement selections in a series 
of Bell tests, operated by two parties (Alice and Bob) 
in distantly separated parts of the same laboratory. The 
correlation statistics of the outcomes are used to violate a 
Bell inequality, giving a quantitative bound on the degree 
to which an adversary or eavesdropper (Eve) is excluded. 
This bound can be used to measure the randomness of 
the outcomes, which can be added to the stock of private 
randomness @]. To certify the private randomness pro- 
duced, it is crucial to not only determine what we call 
the guessing probability G (defined below), but also to 
ensure that Eve cannot somehow fake this bound, per- 
haps by bypassing some of the assumptions used in the 
derivation of the bound. One of these assumptions is 
that Alice and Bob can randomly and independently se- 
lect their measurements. While Alice and Bob could rely 
on making these choices with their own free will, in prac- 
tice they use random number generators (RNGs), which 
Eve could potentially manipulate to deliberately intro- 



duce patterns undetected by standard statistical tests, 
giving rise to the interpretation that Eve compromises 
the free will of Alice and Bob. 

We study the extent to which Eve, by influencing those 
measurement choices, can manipulate the degree of vio- 
lation {S) of a Bell test using a no-signalling model [SJE]. 
Eve does her best to pre-program the outcomes of Alice's 
and Bob's measurements so that, for prescribed S and 
degree of influence upon Alice's and Bob's measurement 
choices, her probability of guessing the measurement out- 
comes correctly is maximized. The more influence she 
has, the less "free will" can be attributed to Alice and 
Bob, and if they wrongly assume that they have com- 
plete free will, they can be fooled into thinking that their 
observed outputs are not predetermined. 

Previous discussions of the free will assumption have 
quantified the concept in differing ways [MSI • The upshot 
is that free will seems to be a critical resource for the 
violation of Bell inequalities in order to derive their usual 
interpretation. Indeed, if free will is given up on 41% of 
the runs of an experiment, singlet state correlations can 
be reproduced from classical correlations 

An operational way of quantifying randomness involves 
the notion of guessing probability or predictability: a pro- 
cess has large randomness if it is hard to guess its out- 
comes. Here we establish bounds on the average proba- 
bility of guessing an outcome of a Bell test, for a given 
amount of free will, using a variant of Hall's relaxed Bell 
inequalities [TIT . While these results require only the no- 
signalling restriction, for comparison, we also establish 
the limiting strategy for a quantum Eve who eavesdrops 
each run independently. 

Model. — We work in the simplest scenario of two par- 
ties, each with two inputs and two outputs, for which 
the Clauser-Horne-Shimony-Holt (CHSH) inequality [TT] 
is the unique Bell test. The devices that Alice and 
Bob use are treated as black boxes, potentially prepared 
by Eve. The inputs are labelled Aj and Bk respec- 
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tively, where j,k g {0,1}, and the outputs are labelled 
a, 6 € {0, 1}. The CHSH test is repeated a large number 
of times, yielding a probability distribution of the outputs 
{p{a, b\Aj, Bk)}, which we assume to be no-signalling. In 
terms of these probabilities, the CHSH correlation func- 
tion S can be defined as 
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In order to study eavesdropping strategies, we will im- 
pose that the probability of each input is equally likely, 
i.e. p{Aj,Bk) = \ for all j,k G {0,1}, which means 
that Alice and Bob, with no knowledge of the underlying 
strategy, are not able to detect any deviations of these 
probabilities from the uniform distribution {\,\,\,\) 
that they expect. Eve's control over the inputs and out- 
puts is described by an underlying variable A, correspond- 
ing to conditional probability densities p{a,b\Aj , Bk, X) 
and p{X\Aj,Bk). These are related by Bayes' theo- 
rem: p{a,b\Aj,Bk) ^ J dX p{a,b\Aj,Bk,X)p{X\Aj,Bk). 
The summation over b and a respectively produce the 
marginals p'^^^a\Aj,X) and p'^^^b\Bk, X). Note that 
the no-signalling assumption imposes that the marginal 
probabilities p'"^-* and p*-^) are independent of i?^ and 
Aj, respectively. 

Guessing probability. — The guessing probability, or 
predictability, G(A) for a given underlying variable A is 
the maximum over all these marginal probabilities 



i5(^)(a|A„A),p(^)(6|Bfc,A) 



G(A) = max 

a.A^ ,h.Bk 



i.e. it upper bounds the probability of Eve guessing one 
of Alice's or Bob's outcomes, knowing a given A is being 
used on a specific run of the experiment. The guessing 
probability, for Alice, Bob or any observer without access 
to the underlying variables, is the weighted average of 
G(A) over A, i.e. 



G= dX p(A)G(A), 



(2) 



where p(A) is the probability distribution of the variable 
A. Note that G takes values in the closed interval [^,1], 
where G = | (G = 1) means that the underlying model 
is completely indeterministic (deterministic). 

For a given Bell violation, tight bounds for G have been 
calculated in the literature [H] for the case of complete 
free will. In order to formulate the relaxation of free 
will, we define a free will parameter, P, as the maximum 
probability that a particular pair of measurement settings 
is chosen, maximized over all control variables A, i.e. 



P = maxp(Aj,Bfc|A). 



(3) 



This quantifies the maximum deviation of p(Aj, Bk\X) 
from the uniform distribution, i.e. the extent of Eve's in- 
fluence over the supposedly free choice. For a 2-party, 



2-setting protocol, P takes values in the interval [^,1]; 
P = J corresponds to the case of complete free will, while 
P = 1 corresponds to a deterministic selection specified 
by Eve. This definition relates directly to the probabil- 
ity that a pair of inputs is chosen for a given underly- 
ing variable. While being more natural for our model, 
this differs from that given in '5], which involves con- 
ditional probability distributions of the underlying vari- 
able given the measurement inputs. Nevertheless, a cor- 
respondence between the two can be found via Bayes' 
Theorem. From these definitions, we obtain the follow- 
ing theorem (proved in Appendix [A|): 

Theorem 1 The maximum possible GHSH expectation 
value S"^^^{G, P), for a guessing probability G and 
free will parameter P, for any no-signalling model with 
p{Aj,Bk) ~ i (i.e. all inputs are equally likely), is 



S'™^'^(G, P) = 



4-8(2G-l)(l-3P) 



- 3' 

P > i 
^ - 3- 



(4) 



We illustrate this result with three limiting cases. If 
Eve knows exactly, for each instance of the measurement, 
what will be measured, then Alice and Bob have no "free 
will" (P = 1); their actions are predetermined. She can 
then pre-program the outcomes of the measurements in 
such a way that the outcomes are completely predictable 
(G = 1), while allowing Alice and Bob to attain any value 
of S up to its maximum value of 4. On the other hand, 
if Eve has no prior knowledge of what will be measured 
(P = |), Alice's and Bob's actions are not predeter- 
mined and hence, we say that they have complete "free 
will" . Any attempts to pre-program the outcomes of the 
measurements with complete predictability (G = 1) will 
result in values S < 2, familiar from the standard CHSH 
inequality. Finally, if Eve gives up any intention of ex- 
tracting information {G — then Alice and Bob could 
share an arbitrary no-signalling distribution, which will 
allow any < 4. 

From Theorem [T] we can estimate Eve's knowledge of 
Alice's and Bob's bits, quantified by G, given that we 
know the CHSH correlation S that Alice and Bob ob- 
serve as well as the free will parameter P. The bound in 
the theorem is tight, i.e. for any G and P, there exists 
a no-signalling model for which the CHSH correlation is 
equal to S'^^^{G,P) (See Appendix [A] for explicit con- 
structions). In particular, suppose that Alice and Bob 
measure a CHSH correlation S. li S < S""'^'^(l, P), then 
Alice and Bob know that the bits could have been com- 
pletely pre-programmed before the Bell measurements 
were carried out. On the other hand, if S' > S'^'^^{1,P) 
(anywhere above the G = 1 (NS) line in Fig.[T]), then Al- 
ice and Bob can conclude that some indeterminism has 
been introduced into the model, and that the guessing 
probability is less than unity. They can then use Eq. Q 
to determine an upper bound for the guessing probability 
G. For the case P > 5, we have S""'^''(1,P) = 4, which 
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FIG. 1: (Color online) The maximal CHSH expectation value 
^maxj-^ p-j pjQ^^gjj against the free will parameter P, for the 
no-signalling (NS) G — 1 model (solid line) , and the quantum 
(Q) G = I model (dashed line). Region III (unshaded) gives 
the set of (5, P) values that can be attained by a deterministic 
G = 1 model (purple line). This means if an (5, P) value is 
found in its complement, i.e. Regions I (darker gray) and 
II (lighter gray), the model which corresponds to that point 
cannot be deterministic, i.e. Eve cannot know for certain 
what the outputs are. Regions II and III together give the set 
of (5, P) values that may be obtained by a quantum G = | 
model (red line). 



implies that G = 1, i.e. Eve can use a deterministic pro- 
tocol to achieve maximal Bell violation. The case where 
P < I is more interesting because only in this case is the 
upper bound on the maximum guessing probability for a 
given CHSH correlation S non-trivial: 



G < min <! i ( 1 
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The observed values for S and G thus give a tight upper 
bound on the guessing probability (Fig. [2), from which 
the trade-off between the degree of free wi 1 and Bell vi- 
olation can be seen. 

Since our motivation is the task of randomness expan- 
sion, we need to evaluate the amount of true random- 
ness that we can produce via post-processing. The de- 
gree to which this can be achieved is characterized by 
the min-entropy, which is used by a classical random- 
ness extraction procedure in order to guarantee total pri- 
vacy of a (shorter) random output string. For a single 
run, the min-entropy is defined to be Hac,{AB\XY) — 
— log2 maXfl 5 ^l^;, y), which is clearly bounded 

from below by — logj G. For experimental estimation of 
a Bell violation, a Bell test must be performed on the 
devices many times in succession. This means that we 
must bound the min-entropy over a series of n runs. If 
we assume that Eve can only perform a collective attack 
without memory, i.e. that the devices behave indepen- 
dently and identically at each run (as in the outlined 
model), thenp(r|s) = p(a"6"|x"j/") = Y\iP{a,bi\xiyi) by 
independence and so _ffoo(^|'S') > — nlog2 G. 



FIG. 2: (Color online) Optimal guessing probability G(S, P) 
for no-signalling models at different CHSH expectation values. 
S — 2 and S — 2\/2 correspond to the local deterministic 
bound, and the Tsirelson bound respectively. For each pair 
of lines, the bound for the general case (purple) is always 
strictly greater than that of the factorizable case (red) , except 
at G = |, 1. In each case, the optimal guessing probabilities 
approach the vertical dotted lines as S goes to 4. 



Restricted adversary. — So far, we have not placed any 
restrictions on the probability distribution p{Aj, Bk\X). 
Indeed, if Eve has quantum technology at her disposal, 
then she would be able to generate the most general of 
such distributions, i.e. RNGs share the entangled state 
I<^a) = J2j,k v/p(^j7-Bfc|A)|j) (S)\k). In its absence, one 
should impose that the probability distributions are fac- 
torizable, i.e. p{Aj,Bk\X) =p('^)(kj|A)p(-^)(Pfe|A). Note 
that while a non-factorizable distribution can always be 
made factorizable by utilizing more hidden variables, 
this changes the value of P. The generation of non- 
factorizable distributions requires a quantum state when 
the underlying variable A is not used. However this re- 
quires measurements in only one basis, hence in some 
sense, any 'quantumness' cannot be detected. 

The results of Theorem [T] hold in the case of an ar- 
bitrary probability distribution. Imposing the factoriz- 
ability condition changes the upper bound for the Bell 
violation. In this shown in Appendix [K\ 



'-'fac ['-'t^} 



4(2G- 1)(1 - 2P) 



P < i 

1' (6) 
P > - 



As expected, this does not exceed the bound in the 
more general case, implying that Eve has less influence 
in the factorizable case than in the general case. The 
upper bound on the guessing probability G for an ob- 
served CHSH expectation value S is analogous to Eq. ([5| , 
upon replacing S™^^ with S^^^ and the validity range by 
P < ^. Also, note that for P = |, corresponding to the 
case of complete free will, the bounds on G for both the 
general and factorizable cases, reduce to the result in [T] : 

r < 3 s 

Quantum limit. — The previously derived bounds apply 
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under the weak assumption of no-signalling, which means 
that Eve might be able to distribute any no-signalling 
distribution between Alice and Bob, such as a PR box 
[131 m], which can give the maximal violation of the 
CHSH inequality. However, if we make the stronger as- 
sumption of quantum mechanics, we know that Eve can 
achieve only much lower limits; in the case of P = 

she can do no better than S = 1^2 — (2G — 1)^ 1 . In 
particular, for G = ^, the well-known Tsirelson bound 

S = 2\/2 is recovered. What happens when we move 
away from P = i? Imagine that Alice and Bob per- 
form a CHSH test and calculate their expectation value 
averaged over all runs of the experiment. In addition, 
suppose that Eve uses a hidden variable model to deter- 
mine the probabilities p{Aj , Bk\X) that, on a given run, 
Alice and Bob use to select their measurement settings. 
As far as Eve is concerned, she just has to optimize her 
quantum strategy for each of the different values of A in- 
dependently, and the weighted probabilities p{Aj , P^ | A) , 
which is effectively as if Alice and Bob (unbeknownst to 
them) are just playing a CHSH sub-game, with the cor- 
relation function given by 



5(A) 



{-l)-+'^+i'^p{a,b\A„Bk)p{A,,Bk\X) 



, E 

a^b.j^k 

. . (7) 

In Appendix |Bj we derive the generalized Tsirelson 
bound for this class of games, and find the optimal dis- 
tribution of probabilities to maximize ^(A) for a given P. 
We also prove that for P < this maximum necessar- 
ily corresponds to the case G = ^. This implies that, for 
the optimal quantum strategy (meaning largest achiev- 



able CHSH expectation value), we have for P < 



omax / 1 r>\ 



3/2 



4(1 - 2P) 
y(1^3P) 



(8) 



For P > a deterministic strategy is used, and hence, 



This considerably restricts the region of operation for 
Eve, as can be seen in Fig. [T] Interestingly, for P > 
j^, there is no quantum strategy that outperforms the 
deterministic strategy. This means that if Alice and Bob 
estimate that P > a randomness expansion protocol 
based on the CHSH inequality cannot function. We have 
not succeeded in finding a closed form for the general 
S'^^^{G, P) tradc-off in the quantum strategy, except for 
recovering known limits such as P = ^ [II and G = 1 
(Eq. Q), although it can be solved numerically. 

Conclusions. — We have shown that by influencing the 
apparently free choice of measurement settings in a Bell 
test, the adversary can fool the participants into thinking 
they share quantum correlations when, in fact, they do 
not and are being manipulated. We have specified the 
optimal models for Eve to maximize the guessing proba- 
bilities based on only no-signalling models, thereby spec- 
ifying, for a given Bell correlation, a bound on the extent 
of private randomness that can be extracted. While this 
analysis has been performed assuming Eve has access to 
devices that can produce any no-signalling distribution 
(including PR boxes, etc.), we have compared this to the 
quantum case. 

A natural extension of this work is to ask whether the 
local strategies employed here could be used to take ad- 
vantage of a key distribution scheme, where Eve fakes a 
Bell violation to undermine the security that Alice and 
Bob believe is in their key. There are a number of sub- 
tleties that necessitate a more detailed study. 
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Appendix A: Proof of Bell violation bounds and 
optimal models 

In this appendix, we will prove Theorem [T] namely the 
tight relationship between the guessing probability, G, 
the free will parameter, P, and the observed CHSH ex- 
pectation value, in both settings, where a generalized 
probability distribution is allowed (Eq. Q), and where 
only a factorizable probability distribution is permitted 
(Eq. B). We start by defining mj = p(^) (0|Aj, A), 
Uk =^)(0|Bfe,A) for j,ke {0,1}. Hence, 

G(A) = max{mo, mi, no, ni, 1 — mo, 1 — mi, 1— no, 1 — ni}. 

If we also define Cjk = p{0,0\Aj, Bk, X), then the other 
probabilities are readily expressed in these terms: 

p{0,l\Aj,Bk,X) = rrij-Cjk, 
p{l,0\Aj,Bk,X) = Uk-Cjk, 
p{l,l\Aj,Bk,X) = 1 + Cjk - rrij ~ Uk. 

In order to prove tight bounds, we will follow the tech- 
niques in [10 . By Eq. (B3) of [TD], 

S<^-2 j dX J(A), 

where J(A) = p(A|Ao, So)|mo - no| + /9(A| Ao, Bi)|mo - 
nil + p(A|^i,Bo)|mi - nol + p(A|^i, Bi)|mi -I- ni - 1| 
and p{X\Aj, Bk) is the probability distribution of A given 
inputs Aj , Bk ■ An upper bound for S corresponds to 
a lower bound for J{X). From the definition of J(A), 
J(A) > (|mo - nol + |mo — ni| + |mi - no| + |mi + 
ni — 1|) minj^fc p{X\Aj, Bk). Consider the expression K = 
l"^o — '^ol + l'7^o — nil + |mi — no| + |mi -|- ni — 1|. 
By applying the triangle inequality to the first and sec- 
ond terms and to the third and fourth terms, we obtain 
K> |no— ^i| + |^o+"'i — 1|- Similarly, applying the trian- 
gle inequality to the first and third terms and to the sec- 
ond and fourth terms gives K > \ tuq — mi | -I- | mo -|- mi — 1 1 . 

Since G(A) was defined as the maximum of a set of 8 
elements {mo, mi, no, ni, 1 — mo, 1 — mi, 1 — no, 1 — ni}, 
it has to be equal to at least one of them. Without loss of 
generality, suppose that G(A) = no. Then no > ni, 1 — 
ni , which implies that if > no— ni+no+ni — 1 = 2G(A) — 
1. Consequently, J(A) > (2G(A) - l)mmj^k p{X\Aj,Bk). 
By Bayes' Theorem and our assumption that p{Aj, Bk) = 

we obtain 

S<4-8 I dX{2G{X)-l)p{X)uiinp{A,,Bk\X). (Al) 

We can now consider different allowable sets of p. 

General case: Using the definition of P in Eq. ([s]), for 
P > i, we could choose p{Aj,Bk\X) = (P,Q,Q',0) for 
some Q,Q' < P, in some order, for each j,k S {0,1}. 
Then u\vaj kp{Aj,Bk\X) = 0, from which it follows that 
^-max = 4. ' For I < P < i, given that P is the largest 
probability, we have v[mijkp{Aj,Bk\X) > 1 — 3P > 0. 
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TABLE I: Optimal indeterministic model with guessing prob- 
ability G in the general case, for | < P < |. No- 
tation: p\{AjBk) means p{Aj,Bk\X) and Pjk\(ah) means 
p(a, b\Aj,Bk, A). 



This bound is sufficient to obtain the expression in Eq. 

Factorizable case: For a separable distribution with 
fixed P = PaPbi where Pa = maXj_A P^"^' (^j 1-^) (and 
similarly for Pb), we need to bound the minimum prob- 
ability, (1 — Pa)(1 — Pb)- This is equivalent to maxi- 
mizing Pa + Pb subject to the conditions PaPr = P 
and Pa,Pb < 1- The optimal values are found to be 
Pa,Pb = (1,P) for P > i and (i,2P) for P < i in 
some order. These values give the bound in Eq. ([6]). 

In order to show that these bounds are tight, we have 
explicitly constructed a no-signalling model. For P < | 
and a general probability distribution, this is given in 
Table m A P > ^ model can be obtained in a similar 
way, for example, by replacing the column px{AjBk) of 
Table |l] by the values, in the same order, ((P, Q, Q', 0), 
(Q',P,0,Q), (Q,0,P,g'), (0,Q',Q,P)), for any g,Q'< 
P that satisfies Q + Q' + P = 1. When P > ^ and 
Q' — 0, we get an optimal model for the factorizable case. 
Replacing the column px{AjBk) of Table |l] by the values, 
in the same order, ((P,P, i-P, 5-P), {\-P\P, ^-P,P), 
(P, ^-P,P, l~P), {\-P,\-P, P, P)) gives an optimal 
P < i model for factorizable distributions. 

Appendix B: Optimal quantum strategies 

While we have demonstrated the optimal strategies 
when allowing for an arbitrary no-signalling distribution, 
it is equally interesting to apply the more physical restric- 
tion of assuming quantum mechanics. The question is, 
for a given 5, how can (in the black-box scenario) Eve 
select the quantum state and infiuence Alice's and Bob's 



6 



choices of measurement settings in order to maximize her 
guessing probabihty. 

We start by asking a simpler question - given a 
particular distribution of measurement settings pjk — 
p{Aj, Bk\X), what is the maximum value of S that Eve 
can possibly achieve? We will then show that for all 
these optimal strategies, we have G — ^, and that for 
a given P = maxpj^, this value of S is optimized when 
minpjfc = 1 — 3P (for P > 1/3 the previous determinis- 
tic model suffices to achieve 5 = 4). This therefore de- 
scribes exactly the region that a quantum Eve can have 
a non-trivial guessing probability. The task of deriving a 
closed-form dependence of G on (5, P) between the G = I 
deterministic line and G = ^ quantum line appears to be 
non-trivial except in special cases. 

Consider a CHSH inequality with non-uniform mea- 
surement distribution. We maximize 



j,fce{o,i} 



for a general probability distribution p ~ 
(poOiPoijPiOiPii)- For such a two-setting, two-outcome 
scenario, it is sufficient to consider just a pair of qubits 
[15j . Hence, the maximization is restricted to all two- 
qubit states and all local operators Aj^Bi^. In the 
black-box scenario, Alice and Bob interpret the outputs 
as ±1 values, imposing that the Aj and have these as 
their eigenvalues, i.e. are Pauli-like. This maximization 
was achieved in a restricted scenario in [16 , which 
gave the maximum value of S when the measurement 
distribution exhibits only local bias, i.e. Alice chooses 
with probability p and Bob chooses with probability q 
so that p = ipq,p{l - q), (1 - p)q, (1 - p)(l - q)). We 
extend their methods to the more general case that can 
be implemented by Eve. 

First, we formulate a Tsirelson-type bound on the ex- 
pectation of outcome correlations: 

<\\Ao(E> (poqBo + PQiBi 

qBq — PiiBi 



\\Ai (g) {pio^ 

<\Jpm+pli +Pomnoi + \Jpw+pli -pwPii 



where 

a = (V-l/® (BoBi+BiBo)l^)- 
A maximum is achieved when 

^ ^ PooPoi(Pio -PioPii(Pot +Poi) 

PooPoiPioPiibooPoi +P10P11) 



a, 
(Bl) 



(B2) 



(B3) 



Substituting Eq. (B3) into Eq. (B2), we obtain 



IpIo+pIi , pIo+pIi 



PooPoi 



PwPii 

(B4) 



While Eq. (B2) can be satisfied only if |a| < 2, for pjk 
which satisfy 



1 1 

Poo Poi 



1 

PlO 



1 



< 0, 



(B5) 



the expression for a in Eq. (B3| gives |q;| > 2. Hence, 



for a > 2, the best approach is to use a = ±2, for which 
the quantum bound coincides with a deterministic strat- 
egy Sf^'^^{p) = 4 — 8pmin, where Pmin is the smallest of 
the four probabilities (for example, if Pmin = Pii, this is 
achieved by pre-programming the devices to always out- 
put -|-1 regardless of the input). 

We now show that for all p with —2 < a < 2 there ex- 
ists a quantum strategy that achieves the quantum bound 
given in Eq. ( B4 ), which exceeds the deterministic bound 
4 — Spmin- We start by using freedom over local unitaries 
to specify that 

Bf) = X, 

Bl = X cosf3 + Zsm/3. 

However, due to the condition a — {BqBi + 

BiBo)\^), this instantly imposes that 2cos/3 — a. One 
can readily verify that by using the initial state and mea- 
surement settings 



1 



72 



(100) + 111)), 



An = 

Ai = 

Bo = 
Bl = 



{Poo + Poi cos /3)X + poi sin /3Z 
V (Poo + Poi cos /3)2 -t- (poi sin /?)2 ' 

(pio - Pii cos f3)X - pii sin /3Z 
V (Pio - Pu COS /3)2 + (pii sin /3)2 ' 
X, 

X cos f3 + Zsin/3, 



(B6) 



the correct expectation value is realized. Note that Aq 
and Ai are the normalized versions of the operators 
PoqBq + poiBi and PiqBq — puBi, respectively. This 
choice was made in order for the equality to hold in Eq. 

Since \4>) is a maximally entangled state, we know that 



the guessing probability G 



However, it remains to 



prove that this strategy is unique, up to local unitaries, 
i.e. that there isn't another strategy with a higher G. We 
already know that Bob's operators are uniquely specified 
up to local unitaries. In order to see that Alice's opera- 
tors are also uniquely specified, it suffices to realize that 
in order to saturate the bound, it must be that whichever 
state \ip) used must simultaneously be the maximal eigen- 
vector of Ao(^{pooBo+poiBi) and Ai (g) (pio-Bo -Pii^O- 
Again, we use local unitary freedom, this time on Alice's 
side, to specify Aq . For instance, we could define Aq as 
we did in Eq. (B6I, and Ai ~ XC0S7 -|- Zsin7. We can 



now diagonalize both operators and ascertain when they 
have a simultaneous maximal eigenvector. Up to sign 
changes such as 7 i— > —7 (which are associated with a 
further local unitary freedom), the unique result is that 
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of the Ai used previously. It is then easy to check that 
the overall operator has only one maximal eigenvector, 
which is \ip). Hence, we can conclude that in the quan- 
tum limit (and within the quantum regime), G = ^. Of 
course, in the region a = 2 we know that G — 1. 

Finally, we investigate the measurement distribution 
p which yields the largest violation for a given P = 
max{pooiPoijPio,Pii}- The probabilities need not be 
ordered, and without loss of generality we choose the 
largest and smallest of these probabilities to be, say. 
Poo = Pmax and Pii = Pmin- The normalization is 

Poo = 1 - Poi -Pio -Pii- 

To find the optimal choice of Sq'^^, we differentiate it 
with respect to poi- This derivative is non-negative in 
the range poi S [Pinin,Pmax]i and zero if and only if 
Poi — Pmax — P, thus this choice maximizes Sq'^^. 
By symmetry, we also demand that pio = P. There- 
fore the optimal measurement distribution (up to per- 



mutations) is (P, P, P, 1 - 3P). Via Eq. (tBSl), we see 



that such a quantum strategy gives an advantage over 
deterministic strategies only when P < ^q- When 
^ < P < |, this distribution still yields the largest vi- 
olation, but is achieved through a deterministic strategy 
with S'™''''(1,P) = 24P - 4, coinciding with the bound 
given in the main text for a general distribution with 
G = 1. 



We conclude that the optimal quantum strategy for a 
fixed J < P < and G — ^ gives the maximum CHSH 
expectation value stated in Eq. (|8|. Since Eve clearly 
has access to quantum technology, there is no reason to 
restrict the probability distribution p. Nevertheless, one 
would obtain 



^Q,ia.c 



/^^^P'^ + (1 - 2P)2, 



for any \ <P<\. 



